The TL;DR
Studies live in your browser tab. We do not run a database. We do not log your pixels. We do not place cookies, run analytics, fingerprint your device, or track you across the web. Every model request is gated through Vercel AI Gateway with disallowPromptTraining: true, which means it can only route to providers contractually committed to never training on your data. If you close the tab, your study is gone.
What we collect — in flight
When you upload screenshots and submit a study, the following data is handled in memory only, for the duration of the request:
- Screenshots, encoded as data URLs, sent to our serverless function and forwarded directly to Vercel AI Gateway.
- Persona text and the research question you typed.
- Standard request headers (IP, user-agent) that any web request produces — used only to serve the response and never associated with your prompt content.
None of these are written to disk, written to a database, or copied into a log line on our infrastructure. Once the model finishes streaming back, the request handler completes and the memory is garbage collected.
What we don't collect
- No cookies.Not for sign-in, not for analytics, not for "preferences". We have no cookie banner because we have no cookies to ask permission for.
- No analytics.No Google Analytics, no Plausible, no PostHog, no Segment, no fingerprinting. We don't know when you visit and we don't want to.
- No marketing pixels. Meta, LinkedIn, Reddit, X — none of them load.
- No accounts.Not yet. When we add billing later, we'll collect an email — and only an email — through Stripe and a passwordless magic-link flow.
Where studies live
A study is stored only in your browser tab's sessionStorage. When you close the tab, the browser deletes it. We do not sync studies across tabs, devices, or accounts, and there is no copy of the study on any server we operate.
A consequence: if you close the tab before reading the report, the report is gone. Use the Copy report button to save the markdown to your own notes if you want a record.
Sub-processors
Two providers see your data in flight:
| Provider | Role | Data they see |
|---|---|---|
| Vercel | Hosting, edge network, AI Gateway routing. | TLS-encrypted requests in flight. No prompt content is logged beyond aggregate metadata for billing. |
| Model providers | Generate the readings. Currently OpenAI, Anthropic, Google, xAI, Meta — gated to no-training-eligible providers. | The screenshots and prompt for the duration of the request. All providers are on Vercel's no-training agreement; see the Security page. |
Your rights
Under GDPR, CCPA, and similar laws you have the right to access, export, and delete personal data we hold about you. The honest answer is that we don't hold any personal data — there is nothing in our systems to access, export, or delete.
If a model provider retains a request transiently for safety review or abuse prevention (typically up to 30 days), that's governed by their privacy policy. Links to each provider's no-training and retention policy are listed on the Security page.
Children's privacy
UXRBuddy is a B2B research tool for product teams. We do not knowingly collect data from anyone under 18. If you believe a minor has used UXRBuddy, please contact us so we can take appropriate action.
Changes to this policy
We'll update this page as the product changes. Material changes (new sub-processors, retention changes) will be announced in the README and on the landing page before they go into effect, not after.
Contact
Privacy questions, security disclosures, or requests for a more formal data-processing agreement: hello@uxrbuddy.com.